8aec2fdb3fd8616efdced65afffaa7d98f1db4cfce9407f2f90063edfa441174

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 17:27

Target

314c658ae62ee0b42c2b0314633ffaf0_JaffaCakes118.dll
Size

88KB
MD5

314c658ae62ee0b42c2b0314633ffaf0
SHA1

c3d748885261e41a10dc7ce4d4d4f2195321268c
SHA256

8aec2fdb3fd8616efdced65afffaa7d98f1db4cfce9407f2f90063edfa441174
SHA512

5431ceb58e528f0dacaa1eb92d95670e7e212cba41e7eedd5b0550e9bce9c565ec3ca0c41f582f5177294fa5b7fc4ef3e1056315b4d40ea6cf37c0a08901ab69
SSDEEP

1536:860lILUkCYmZYfeTVvZInWSQWhImr9ot4XgORDSVLvLz52rdfzDKCl1ZIS:nsmUk0Ae7InWSNhzr9I4g2S9yfyEnIS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	2608	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2608	2852	regsvr32.exe	80
PID 2852 wrote to memory of 2608	2852	regsvr32.exe	80
PID 2852 wrote to memory of 2608	2852	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\314c658ae62ee0b42c2b0314633ffaf0_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\314c658ae62ee0b42c2b0314633ffaf0_JaffaCakes118.dll
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 596
    3⤵
    - Program crash
    PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2608 -ip 2608
1⤵
PID:3528

memory/2608-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download